A pair of newly disclosed security flaws in PHP, the programming language behind a huge share of the internet, has set off one of the most widespread precautionary shutdowns of government websites in recent memory.
Emergency patches are now available, but for much of Wednesday and into Thursday, administrators across several continents faced a stark choice: update immediately or take exposed systems offline.
What the flaws are
The two PHP vulnerabilities are catalogued as CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 out of 10 and can allow an unauthenticated attacker to run malicious code on a server remotely, with no login required. Media reports have dubbed the pair “PHP2Shell”.
PHP is used by about 69 percent of websites, according to the survey firm W3Techs. Its developers said any installation serving web requests could be affected, including those running PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed. They rated the risk highest for mod_php, where a demonstrated exploit can trigger the attack before any application code even runs.
Fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Governments pull the plug
Australia’s cyber agency, the Australian Signals Directorate (ASD), issued a “critical” alert on Wednesday and warned that versions from PHP 5 onward might be affected before full details were public. Its own public website, cyber.gov.au, was among those reported offline. On Thursday morning the Australian Bureau of Statistics briefly took its sites down to apply updates.
The disruption stretched well beyond Australia. Finland took government services offline, and the websites of the Dutch parliament, cybersecurity authorities and data protection regulator were also pulled as a precaution. France’s Interior Ministry temporarily took local government administration sites offline, and sites in Germany and Austria were affected. Wikipedia said it was rolling out the fix, and the Internet Archive was among other well-known sites affected.
The EU’s CERT-EU advised that organisations unable to patch right away should isolate internet-facing applications from public networks. The US National Security Agency urged users to prepare updates, warning the flaws could give attackers direct access to server file systems and databases. Authorities in Singapore, the United Kingdom, Canada and the EU issued similar alerts.
Exploitation: what is known and what is not
The picture on active attacks is murky. Australia’s ACSC said it was not aware of active exploitation. Some reports, however, noted that exploit code had already been published, and a few outlets said hackers were believed to be using it. Security teams generally treat published exploits as a signal to patch immediately.
It is also important to separate three things: a warning, an outage and a breach. Most of the outages seen so far were deliberate precautions, not evidence that attackers had broken in.
An AI-assisted discovery and an embargo row
Technology companies have also been drawn in. OpenAI said researchers working with its AI models helped uncover critical vulnerabilities in PHP, and the security firms Calif and Wiz said they coordinated with OpenAI and the PHP team. Google and Amazon responded with their own mitigation work.
The disclosure was not smooth. The PHP Foundation alleged that Chainguard, a company that builds secure open-source software, shared details of the patch about six hours before the agreed release time, breaking an embargo. Chainguard’s account of the matter was not included in the reports reviewed.
What organisations should do now
The advice is straightforward. Identify every system running PHP, including content management systems, hosting platforms and older internal tools. Update to a patched release, or apply the vendor’s fix if you rely on a managed service. Where patching is not possible immediately, isolate exposed servers and review logs for unusual requests since the vulnerabilities became public.
The episode is also a reminder of how much of the internet depends on shared open-source components, and how fast the window between discovery and exploitation can close when AI tools are helping both defenders and, potentially, attackers.
Next Article
